The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Capital Markets/Hedge Fund/Private Equity
Breach intelligence, attack campaigns, and threat reports targeting the Capital Markets/Hedge Fund/Private Equity sector.
Explore Other Sectors
Capital Markets/Hedge Fund/Private Equity Threat Reports
SourTrade Malvertising Campaign: A New Era of Browser-Based Threats
In July 2026, a sophisticated malvertising campaign named SourTrade was identified, targeting retail traders and cryptocurrency investors across 12 countries. Active since late 2024, the attackers impersonated reputable platforms like TradingView, Solana, and Luno to lure victims. Instead of delivering a static malicious file, the campaign utilized the victims' browsers to assemble unique Windows executables in memory, leveraging a legitimate Bun runtime. This method effectively evaded traditional security detections by ensuring no complete malware existed on the network. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/?utm_source=openai)) The SourTrade operation underscores a significant evolution in malvertising tactics, highlighting the increasing sophistication of threat actors in circumventing security measures. This incident serves as a critical reminder for organizations to enhance their cybersecurity defenses, particularly against advanced browser-based threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/?utm_source=openai))
2 months ago
Kill Chain
SourTrade Malvertising Campaign: A New Era of In-Browser Malware Assembly
In July 2026, a sophisticated malvertising campaign named 'SourTrade' was identified, targeting retail traders and cryptocurrency investors across 12 countries, primarily in the Asia-Pacific and Latin American regions. The attackers employed fake websites impersonating platforms like Solana, Luno, and TradingView, utilizing malicious JavaScript to assemble malware directly within the browser's memory. This method involved registering service workers and shared workers to incrementally build a unique malware payload for each session, effectively bypassing traditional static detection mechanisms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/amp/?utm_source=openai)) The campaign's innovative approach underscores a growing trend among cybercriminals to exploit browser functionalities for malware delivery, making detection and analysis more challenging. This incident highlights the urgent need for enhanced security measures and user vigilance, especially within the cryptocurrency and financial sectors, to counteract evolving threats that leverage in-browser execution and memory-based payload assembly. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/amp/?utm_source=openai))
2 months ago
Kill Chain
Ostium's $23.75 Million Crypto Theft: A Wake-Up Call for DeFi Security
In July 2026, Ostium, a decentralized trading platform on the Arbitrum blockchain, suffered a significant security breach resulting in the theft of approximately $23.75 million from its liquidity provider vault. The attacker compromised off-chain infrastructure responsible for feeding price data into the protocol, submitting falsified price reports to artificially generate profits. This manipulation allowed the attacker to rapidly open and close large positions, effectively draining the vault. Notably, trader collateral held in separate contracts remained unaffected, and existing positions were preserved. This incident underscores the critical vulnerabilities associated with off-chain components in decentralized finance (DeFi) platforms. As DeFi continues to gain traction, the reliance on external data feeds presents a substantial risk vector. The Ostium breach highlights the urgent need for enhanced security measures and robust validation mechanisms to protect against similar exploits in the future.
2 months ago
Kill Chain
US Charges Two Over $43 Million Investment Fraud Laundering
In July 2026, U.S. prosecutors charged Zhuoying Chen and Haojie Zhang, residents of New York, for orchestrating a sophisticated money laundering network between 2020 and 2022. The duo managed over a dozen individuals who opened approximately 140 bank accounts under 45 shell companies, facilitating the transfer of at least $43 million from cyber investment fraud victims to bank accounts in China. The fraudulent schemes involved contacting victims via social media, building trust, and persuading them to invest in fake opportunities, ultimately leading to significant financial losses. This case underscores the escalating threat of cyber-enabled financial fraud and the critical need for robust cybersecurity measures. With investment fraud accounting for 49% of all scam-related incidents in 2025, resulting in losses of $8.6 billion, organizations must prioritize the implementation of advanced security protocols to protect against such pervasive threats.
2 months ago
Kill Chain
Silent Swap Crypto Clipper: A New Threat to Cryptocurrency Security
In June 2026, cybersecurity researchers identified a malicious campaign named 'Silent Swap,' which targets cryptocurrency users through a fake 'Google Notes' browser extension. Delivered via unsigned .NET and Golang installers, this extension infiltrates Chromium-based browsers by modifying their settings to install itself without user consent. Once active, it monitors the system clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, leading to unauthorized fund transfers. The campaign employs advanced techniques like 'EtherHiding,' utilizing blockchain technology to dynamically update command-and-control servers, enhancing its resilience and evasion capabilities. This incident underscores a growing trend of sophisticated attacks leveraging trusted platforms and applications to distribute malware. The use of blockchain for command-and-control infrastructure highlights the evolving tactics of threat actors, making detection and mitigation more challenging. Organizations and individuals must remain vigilant, ensuring that browser extensions are sourced from reputable developers and regularly reviewing installed extensions for unauthorized additions.
2 months ago
Kill Chain
Crypto Heist Leveraging Fake Reputation Networks to Distribute Malware
In June 2026, cybercriminals orchestrated a sophisticated campaign to distribute a Rust-based clipboard hijacking malware targeting both Windows and macOS users. The attackers created a comprehensive fake reputation network, utilizing GitHub repositories, SourceForge projects, AI-generated YouTube videos, and manipulated VirusTotal comments to lend credibility to their malicious tools. These tools, masquerading as crypto trading and gambling aids, were designed to steal cryptocurrency by intercepting wallet addresses copied to the clipboard, affecting assets like Bitcoin, Ethereum, Monero, Binance Chain, and Solana. This incident underscores a significant evolution in cybercriminal tactics, highlighting their ability to exploit multiple trusted platforms to build false credibility and deceive users. The campaign's success demonstrates the urgent need for enhanced vigilance and skepticism towards online reputation signals, especially in the cryptocurrency domain, where the allure of quick profits can cloud judgment.
3 months ago
Kill Chain
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
3 months ago
Kill Chain
Escalating Cyber Threats from North Korea and China Target Asia-Pacific Financial Institutions
In 2025, cyber threat groups linked to North Korea and China intensified their attacks on financial institutions and cryptocurrency assets in the Asia-Pacific region. North Korean adversaries, notably PRESSURE CHOLLIMA, executed the largest financial theft to date, stealing $1.46 billion in cryptocurrency through a supply chain compromise. Concurrently, Chinese threat actors like HOLLOW PANDA targeted financial institutions across multiple countries, including the Philippines, Indonesia, and Brazil. These operations leveraged advanced techniques, including AI-generated identities and sophisticated social engineering tactics, to infiltrate organizations and exfiltrate sensitive data. ([crowdstrike.com](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-financial-services-threat-landscape-report/?utm_source=openai)) The escalation of these cyber activities underscores a growing trend of state-sponsored cybercrime aimed at financial gain and intelligence collection. The increasing sophistication and frequency of these attacks highlight the urgent need for enhanced cybersecurity measures and international collaboration to protect financial infrastructures from such persistent threats.
3 months ago
Kill Chain
OceanLotus Targets Vietnamese Investors via FireAnt Metakit Supply Chain Attack
Between mid-2024 and March 2026, the Vietnam-aligned threat actor OceanLotus (APT32) conducted cyber espionage campaigns targeting domestic entities. Notably, from October 2025 to March 2026, they executed a supply chain attack by compromising the update mechanism of FireAnt Metakit, a widely used stock investment platform in Vietnam. This allowed them to distribute the SPECTRALVIPER backdoor to a select group of investors, facilitating unauthorized access and data exfiltration. This incident underscores a strategic shift by OceanLotus towards domestic targets, highlighting the evolving threat landscape where nation-state actors exploit trusted software supply chains to infiltrate critical sectors. Organizations must enhance their software supply chain security and implement robust monitoring to detect such sophisticated attacks.
3 months ago
Kill Chain
Zcash's Orchard Privacy Pool Vulnerability: Discovery and Resolution
In May 2026, security researcher Taylor Hornby discovered a critical vulnerability in Zcash's Orchard privacy pool, which had been present since its activation in May 2022. This flaw could have allowed attackers to create unlimited, undetectable counterfeit ZEC tokens by exploiting a validation check failure in the zero-knowledge proof system. The Zcash team promptly addressed the issue by implementing a two-phase network upgrade, including a hard fork named NU6.2, to rectify the vulnerability. Despite the fix, the incident led to a significant decline in ZEC's market value, with prices dropping approximately 30% following the disclosure. The discovery underscores the potential for advanced AI models to uncover previously unknown vulnerabilities in cryptographic systems, raising concerns about the security of systems not yet tested against such tools.
3 months ago
Kill Chain
DoJ's 'Disruption Week' Targets Southeast Asia Crypto Fraud Networks
In May 2026, the U.S. Department of Justice (DoJ), in collaboration with major tech companies and international law enforcement agencies, launched 'Disruption Week' to combat cyber-enabled and cryptocurrency fraud targeting Americans. This operation led to the takedown of over 1.4 million fraudulent accounts across platforms like Facebook and Instagram, the suspension of approximately 20,000 Microsoft accounts, and the freezing of over $3.8 million in cryptocurrency assets. Additionally, seven individuals were arrested in Thailand, and multiple scam centers in Southeast Asia were disrupted. ([justice.gov](https://www.justice.gov/opa/pr/scam-center-strike-force-announces-results-us-private-industry-disruption-week?utm_source=openai)) This incident underscores the escalating threat of transnational cyber fraud, particularly involving cryptocurrencies. The significant financial losses reported in recent years highlight the urgent need for coordinated international efforts to dismantle these sophisticated scam networks and protect vulnerable individuals from financial exploitation. ([justice.gov](https://www.justice.gov/opa/pr/scam-center-strike-force-announces-results-us-private-industry-disruption-week?utm_source=openai))
3 months ago
Kill Chain
Prolonged Espionage: Hackers Exploit Stock Exchange Executive's Outlook Mailbox
Between October 2025 and March 2026, attackers infiltrated the Outlook mailbox of a senior executive at a major global stock exchange, maintaining undetected access for approximately 150 days. They exfiltrated sensitive data in small, incremental batches using legitimate cloud services like Dropbox and OneDrive, effectively blending malicious activity with normal network traffic. The attackers employed malware disguised as trusted software components and utilized scheduled tasks for persistence, enabling continuous monitoring and extraction of confidential communications, schedules, and potentially market-moving information. ([securityweek.com](https://www.securityweek.com/hackers-target-global-stock-exchange-in-espionage-operation/?utm_source=openai)) This incident underscores the increasing sophistication of cyber-espionage campaigns targeting high-level executives to access sensitive organizational data. The use of legitimate cloud services for data exfiltration highlights the challenges in detecting such stealthy operations, emphasizing the need for enhanced monitoring and security measures to protect executive communications. ([cyberleveling.com](https://cyberleveling.com/blog/stock-exchange-espionage-executive-email-2026?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports